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Reliability  ol  the  Gas  Supply  in  the  Air  Force 
Emergency  Passenger  Oxygen  System 


introduction 

An  emergency  aboard  an  aircraft  can  require  individual 
protection  from  hypoxia,  smoke,  and  fumes.  Generally, 
this  type  of  protection  can  be  offered  through  the  avail¬ 
ability  of  protective  breathing  equipment  (PBE),  com¬ 
monly  referred  to  as  a  “smoke  hood.”  PBE  devices  have 
been  designed  for  both  aircraft  passengers  and  crew.  It 
is  recognized  that  crewmembers  require  the  protection 
offered  by  PBE  to  successfully  complete  their  assigned 
tasks  in  emergency  situations.  Performance  standards  for 
crewmember  PBE  call  for  specific,  functional  capabilities 
and  have  been  relatively  well  defined  (Society  of  Auto¬ 
motive  Engineers  Aerospace  Standards  8031  and  8047, 
Federal  Aviation  Administration  Technical  Standard 
Orders  C99  and  Cl  16  [7]).  Safety  benefits  in  providing 
PBE  to  passengers  aboard  commercial  transport  category 
aircraft  are  a  subj  ect  of  debate  (6) .  Although  some  guide¬ 
lines  have  been  created  (The  European  Organization  for 
Civil  Aviation  Equipment,  ED-65),  no  governing  body 
currently  mandates  or  regulates  “smoke  hood”  type  de¬ 
vices  for  transport  category  aircraft  passengers.  However, 
due  to  the  potential  benefits  of  the  devices  in  certain 
circumstances,  many  private  and  military  organizations 
have  made  the  decision  to  equip  their  aircraft  with  PBE 
for  passengers. 

The  United  States  Air  Force  Air  Mobility  Command 
(AMC)  recognized  the  need  for  a  readily  accessible,  por¬ 
table  passenger  protective  system  to  supply  passengers 
with  oxygen  and  protect  them  from  the  effects  of  altitude, 
smoke,  and  toxic  fumes.  After  an  extensive  evaluation  and 
testing  of  available  devices  suited  for  passenger  protection, 
a  “smoke  hood”  type  of  device  was  selected.  The  Essex 
PB&R  Corporation  manufactures  the  device.  The  U.  S. 
Air  Force  calls  the  device  the  Emergency  Passenger  Oxy¬ 
gen  System  (EPOS).  These  units  contain  a  single  oxygen 
cylinder  that  is  required  to  provide  a  supply  of  oxygen 
to  the  user.  Recently,  questions  regarding  the  stability  of 
the  oxygen  cylinder  were  presented  to  the  Air  Force.  It 
was  hypothesized  that  the  oxygen  cylinders  leaked  and 
that  the  severity  of  the  leak  might  be  sufficient  to  result  in 
the  EPOS  being  unable  to  meet  its  intended  purpose.  To 
examine  this  possibility,  the  oxygen  cylinders  from  EPOS 
units  were  collected  and  tested.  The  Civil  Aerospace  Medi¬ 
cal  Institute  (CAMI)  was  requested  to  perform  the  testing 
by  the  U.S.  Air  Force  Office  of  Special  Investigations. 


The  devices  tested  were  the  Essex  VRU  provided  to 
the  Air  Force  as  a  Passenger  Smoke  and  Fume  Protective 
Device  (PSFPD),  designated  as  the  EPOS.  The  purpose 
of  the  testing  was  to  evaluate  the  oxygen  content  in  the 
cylinders  from  units  that  had  been  manufactured  over 
a  representative  range  of  dates.  The  goal  was  to  address 
a  very  specific  EPOS  component,  the  oxygen  cylinder. 
Emphasis  was  placed  on  possible  leakage  from  these 
cylinders  as  indicated  by  the  mass  (weight)  of  oxygen 
they  contained. 

METHODS 

A  total  of  92  cylinders  were  checked.  All  of  the  cylinders 
were  of  the  same  design.  A  representative  range  of  dates  of 
manufacturer  was  desired.  To  achieve  this,  the  Air  Force 
Office  of  Special  Investigations  collected  two  different 
groups  of  EPOS.  The  first  group  totaled  46  cylinders  with 
estimated  dates  of  manufacture  between  January  1999  and 
November  2003.  The  second  group  (n=23)  of  cylinders 
came  from  units  manufactured  between  August  1996 
and  November  1 997.  The  manufacturer  provided  a  third 
group  of  cylinders.  The  estimated  date  of  manufacture 
of  these  PBE  (n=8)  fell  between  March  1992  and  April 
1993.  Older  samples  of  individual  cylinders  were  also 
provided.  They  totaled  seven  cylinders  from  the  January 
1989  to  the  August  1990  timeframe.  For  each  cylinder, 
the  following  information  was  recorded:  the  unit  serial 
number,  the  cylinder  bottle  number,  the  production  batch 
designation,  and  the  weight  at  manufacture.  Four  tests 
related  to  the  potential  loss  of  oxygen  from  the  cylinders 
were  conducted. 

Terr  i.  The  EPOS  units  were  received  in  their  standard 
vacuum-packaged  condition.  This  process  is  designed  to 
minimize  exposure  to  humidity  that  might  compromise 
the  carbon  dioxide  scrubbers.  The  first  test  took  a  gas 
sample  from  the  units  in  which  the  vacuum  packaging 
appeared  to  be  intact.  A  hypodermic  needle  was  attached 
to  the  sampling  line  of  a  mass  spectrometer  (Perkin-El- 
mer.  Model  MCA- 1 100).  The  needle  was  inserted  into 
the  vacuum  packaging,  and  a  20-30  second  sample  was 
taken  at  one  sample  per  second.  Cylinders  in  which  the 
vacuum  packaging  had  obviously  been  compromised 
were  excluded. 
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Test  2.  The  EPOS  units  were  carefully  disassembled 
so  as  not  to  activate  the  oxygen  release.  Each  unit  and 
cylinder  had  the  aforementioned  information  recorded. 
Then  the  cylinder  was  weighed  (in  grams)  on  an  electronic 
balance  (Ohaus,  Model  TP4KD) .  The  difference  between 
the  present  cylinder  weight  and  the  weight  stamped  on 
the  cylinder  at  manufacture  was  calculated. 

Test  3.  A  primary  interest  serving  as  the  basis  of  the 
testing  was  whether  or  not  the  cylinders  were  leaking 
oxygen  over  time.  It  was  theorized  that  if  this  were  the 
case  and  the  leakage  was  based  on  diffusion,  the  process 
would  be  accelerated  by  altitude  exposure.  Therefore,  the 
cylinders  were  placed  in  the  CAMI  hypobaric  research 
chamber  and  exposed  to  a  simulated  altitude  of  40,000 
feet  for  4  hours.  They  were  weighed  after  the  exposure  and 
the  pre-  and  post-flight  weight  difference  calculated. 

Test  4.  The  oxygen  was  released  from  the  cylinder, 
and  the  cylinder  was  weighed.  The  difference  in  weight 
between  the  empty  cylinder  and  all  previous  weight  de¬ 
terminations  was  calculated. 

RESULTS 

The  concept  underlying  the  first  test  was  that  leakage 
from  the  cylinders  would  increase  the  oxygen  concentra¬ 
tion  in  the  vacuum  packaging  protecting  the  EPOS.  If  the 
volume  of  leakage  was  large  enough,  it  could  potentially 
rupture  the  packaging.  Of  the  69  EPOS  units  collected  by 
the  Air  Force  Office  of  Special  Investigations,  the  vacuum 
seal  of  four  had  been  compromised.  Two  of  the  four  had 
obvious  signs  of  intentional  alteration.  A  square  hole  had 
been  cut  in  one  package,  and  the  other  had  been  partially 
opened  in  a  manner  consistent  with  the  instructions.  The 
other  two  compromised  packages  were  a  bit  more  suspi¬ 
cious.  Both  were  ruptured  along  the  seam  of  the  packaging. 
This  is  an  area  that  is  probably  most  susceptible  to  the 
issues  of  an  increase  in  pressure.  A  graph  of  data  repre¬ 
sentative  of  the  results  obtained  from  testing  the  other  65 
EPOS  is  presented  in  Figure  2.  The  atmospheric  oxygen 
concentration  was  20.9±0. 1%  prior  to  sampling  from  the 
package;  the  oxygen  concentration  in  the  package  was 
20.9±0. 1%,  and  atmospheric  oxygen  was20.9±0. 1%  after 
sampling  from  the  package.  These  numbers  supported  a 
conclusion  that  no  significant  amount  of  oxygen  leaked 
out  of  the  cylinders  and  increased  the  package  internal 
oxygen  concentration.  This  assumes  that  the  packaging 
is  impermeable  to  atmospheric  gases. 

The  differences  in  the  current  cylinder  weights  and 
the  cylinder  weights  at  manufacture  (expressed  in  oxygen 
weight)  are  presented  in  Figure  3.  Weights  for  all  92 
cylinders  are  presented  in  order  of  increasing  produc¬ 
tion  batch  designation.  At  manufacture,  the  cylinders 


are  designed  to  contain  24.7±0.6  grams  of  oxygen.  Seven 
cylinders,  7.6%,  fell  outside  of  the  range  of  two  standard 
deviations,  assuming  the  difference  represents  a  loss  of 
oxygen.  The  average  and  standard  deviation  of  oxygen 
shortage  for  this  subset  is  6.8±5.1  grams.  Two  cylinders 
that  were  light  by  14.4  and  12.8  grams  were  the  major 
contributors  to  the  large  variance.  These  were  the  same 
two  cylinders  that  had  the  vacuum  packaging  ruptured 
along  the  seams.  Four  of  the  seven  cylinders  that  were 
not  within  manufacturer  weight  specifications  were  from 
the  same  production  batch-designation. 

The  altitude  test  was  performed  to  determine  if  an 
increased  pressure  differential  led  to  a  loss  of  oxygen 
from  the  cylinder.  The  weight  changes  are  presented  in 
Figure  4.  Although  one  bottle  lost  0.4  grams  of  oxygen 
after  altitude  exposure,  the  oxygen  level  of  this  particu¬ 
lar  bottle  remained  within  manufacture  specifications. 
Weight  consistency  after  altitude  exposure  suggested  that 
any  oxygen  loss  from  an  increased  pressure  differential  was 
functionally  non-existent.  This  conclusion  was  further 
supported  by  the  fact  that  the  Air  Force  Office  of  Special 
Investigations  had  collected  a  number  of  the  EPOS  that 
had  been  installed  aboard  aircraft.  The  weights  of  these 
units  were  no  different  than  the  ones  yet  to  be  used  on 
flights. 

The  difference  between  the  current  weight  and  the 
empty  cylinder  was  considered  as  the  mass  of  oxygen 
contained  in  the  cylinder.  These  levels  are  plotted  in 
Figure  5.  As  anticipated,  the  differences  between  the 
weight  designation  at  manufacture  and  the  current  weight 
is  representative  of  a  low  oxygen  level.  In  the  cylinders 
that  were  low,  the  sum  of  this  difference  and  the  oxygen 
mass  measured  (23.2±0.2  grams)  was  below  the  level  that 
the  cylinders  were  supposed  to  contain  at  manufacture. 
The  two  cylinders  with  the  lowest  oxygen  levels  (10.3 
and  11.9  grams)  were  from  production  batch  designa¬ 
tions  indicating  manufacturing  dates  between  March 
and  May  of  1997. 

DISCUSSION 

The  reason  for  these  tests  was  to  determine  if  the  EPOS 
had  oxygen  supply  deficits  that  would  prevent  them  from 
performing  as  intended  in  an  emergency  situation.  In 
general,  the  results  indicated  that  the  large  majority  of 
cylinders  contained  a  level  of  oxygen  consistent  with 
cylinder  design  specifications.  Seven  of  the  92  cylinders 
tested  had  oxygen  levels  below  what  is  specified.  These 
findings  should  be  considered  in  functional,  statistical, 
and  historical  terms. 

Theoretically,  the  cylinders  are  designed  to  contain 
approximately  17.3  liters  of  oxygen  (-24.7  grams).  This 
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supply  is  required  to  provide  a  viable  gas  mixture  for 
breathing  to  the  user.  If  15  minutes  is  considered  as  a 
representative  time  frame,  an  average  of  1.15  liters  of 
oxygen  per  minute  would  be  provided.  This  volume 
represents  a  little  over  three  times  what  a  198-pound 
(90kg)  individual  would  be  anticipated  to  utilize  at  rest. 
It  would  be  expected  to  support  a  work  level  in  the  range 
of  80-85  watts.  The  actual  demand  placed  on  the  device 
probably  would  fall  between  these  two  extremes.  Picking 
the  average  between  these  two  values  results  in  an  oxygen 
consumption  level  of  "O.Zdl/min  which  supports  a  work 
rate  in  the  range  of  50-55  watts.  Using  this  scenario, 
only  the  most  deficient  cylinders  (i.e.,  those  containing 
10.3  and  11.9  grams  of  oxygen)  would  fail  to  provide 
15  minutes  of  breathable  gas.  The  other  five  would  be 
provide  1 8  minutes  or  more  under  this  scenario. 

Another  approach  might  be  to  consider  the  oxygen 
levels  in  the  context  of  FAA  Technical  Standard  Order 
(TSO)-Cl  16.  For  a  90kg  individual,  the  exercise  profile 
outlined  could  be  expected  to  demand  about  19.7  liters 
of  oxygen.  Thus,  the  PBE  design  meeting  the  TSO  has 
two  oxygen  cylinders.  If  the  findings  from  these  samples 
were  projected  onto  testing  of  that  design,  the  only  com¬ 
bination  that  would  fail  due  to  insufficient  oxygen  would 
be  the  one  that  had  the  two  most  deficient  bottles  built 
into  the  same  hood.  Together,  those  two  cylinders  would 
supply  roughly  78%  of  the  required  oxygen.  Any  other 
combination  of  cylinders  would  be  anticipated  to  pass  the 
performance  criteria  for  oxygen  supply.  A  single-cylinder 
EPOS  is  designed  to  provide  88%  of  the  demand  required 
by  the  TSO.  Between  69-81%  would  be  provided  by  the 
five  cylinders  that  had  a  reduced  oxygen  level.  The  pre¬ 
ceding  hypothetical  analysis  demonstrates  the  disparity 
between  a  manufacturing  specification  of  a  component 
and  the  overall  performance  of  a  device.  This  relation¬ 
ship  makes  statistical  characterization  of  the  results  very 
difficult  in  terms  of  EPOS  performance. 

Means  of  analyzing  “one-shot”  devices  have  been  es¬ 
tablished  (3,  5).  Again,  the  problem  that  presents  itself 
in  this  particular  case  is  whether  or  not  the  cylinder  oxy¬ 
gen  levels  below  specifications  result  in  EPOS  units  that 
functionally  fail  to  meet  intended  use  requirements.  If  all 
those  cylinders  are  considered  hood  “failures,”  there  is  no 
way  a  confidence  level  for  reliability  consistent  with  the 
mandates  of  the  TSO- 1 1 6  could  functionally  be  achieved. 
In  practice,  this  holds  true  even  if  only  the  two  most 
deficient  oxygen  cylinders  are  considered  to  represent 
PBE  failures.  It  must  be  recognized  that  the  mandates 
ofTSO-Cl  16  are  not  the  performance  criteria  required 
by  the  Air  Force. 

The  Air  Force  did  not  specifically  define  the  required 
duration  of  use  in  the  Technical  Order  that  originally 


described  the  PBE  systems  that  were  being  considered 
for  procurement.  They  characterized  the  duration  of  use 
into  heavy,  light- to-moderate,  and  sitting  workloads  for  a 
1 54-pound  (7 0  kg)  individual.  The  device  was  designed  to 
function  for  5,  20,  and  “up  to”  60  minutes,  respectively, 
for  each  of  these  conditions.  Meaningful  interpretation 
of  these  guidelines  in  light  of  human  variation  is  difficult. 
Working  through  these  durations  of  use  from  rest  may 
provide  some  insight.  Expected  oxygen  requirements 
at  rest  would  be  0.245  L/min  for  a  70kg  person.  This 
results  in  duration  of  use  of  approximately  70  minutes. 
The  deficient  cylinders  would  provide  29.4,  34.0,  55.5, 
56.9,  61.5,  64.0,  and  65.2  minutes  of  oxygen.  Obvi¬ 
ously,  only  the  two  most  deficient  cylinders  fall  out  of 
the  designated  range.  Assuming  a  heavy  workload  uses 
all  of  the  oxygen  in  5  minutes,  the  individual  would  be 
using  3. 5  L/ min.  This  would  require  oxygen  utilization  at 
approximately  50  ml/kg/min.  That  is  about  14  times  the 
resting  metabolic  rate  and  a  power  output  of  250  watts. 
A  20-minute  duration  allots  0.865  L/min.  This  projects 
to  an  oxygen  utilization  of  12  ml/kg/min  or  about  3.5 
times  the  resting  demand  representing  a  power  output 
of 60-65  watts.  These  are  reasonable  workloads,  but  each 
level  calculated  represents  a  number  of  assumptions, 
though  valid,  may  or  may  not  be  applicable.  Without 
more  definitive  performance  specifications,  definitive 
characterization  of  the  manufacture  specification  for  the 
cylinders  is  not  possible. 

From  a  historical  perspective,  protective  breathing 
equipment  of  this  general  design  has  been  in  use  for  at 
least  1 5  years.  The  devices  have  been  tested  with  human 
subjects  in  terms  ofperformance  at  low  altitudes  (4),  evacu¬ 
ation  from  aircraft  (8),  and  in  comparison  with  other  PBE 
designs  (9) .  Oxygen  levels  have  been  specifically  monitored 
in  more  recent  tests  related  to  the  performance  of  the  EPOS 
(1)  and  EPOS  improvements  (2).  There  is  no  indication 
in  the  reports  involving  human  subjects  that  the  PBE  had 
to  be  doffed  as  a  result  of  lack  of  oxygen.  Similarly,  no 
oxygen  deficiency  was  observed  in  performance  testing. 
Database  searches  of  aviation-related  literature  did  not 
identify  any  reports  of  crewmember  PBE  failures  related 
to  oxygen  want.  This  accumulated  information  related  to 
the  general  design  of  the  EPOS  suggests  that  it  is  a  reliable 
piece  of  equipment.  That  does  not  mean  that  the  large 
oxygen  shortage  observed  in  two  of  the  cylinders  should 
not  be  addressed  and  remedied. 

Maybe  the  most  important  question  to  be  considered 
is  “Why  did  the  cylinders  have  low  amounts  of  oxygen?” 
The  data  collected  do  not  indicate  a  systematic  leakage 
either  with  time  or  increased  pressure  differential.  The 
deficient  cylinders  were  simply  low.  Although  circumstan¬ 
tial  evidence  of  the  packaging  being  torn  could  indicate 
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leakage  from  the  cylinder,  the  conditions  that  stopped 
the  process  during  altitude  testing  are  hard  to  imagine. 
The  simplest  explanation  would  appear  to  be  that  the 
cylinders  were  not  adequately  filled  during  manufacture. 
This  could  be  a  function  of  manufacturing  processes, 
component  cleaning,  or  other  quality  control  issues. 
These  and  any  other  possible  explanations  need  to  be 
investigated  if  they  have  not  already  been  accomplished. 
The  cylinders  with  the  largest  oxygen  deficiencies  were 
manufactured  in  1997.  The  possibility  exists  that  the 
reasons  underlying  the  deficiency  have  been  identified 
and  addressed  in  terms  of  specific  remedial  action.  The 
potential  reduction  in  oxygen  represented  by  the  worst- 
case  cylinders  would  represent  a  significant  reduction  in 
the  duration  of  protection  for  the  user. 

SUMMARY  AND  CONCLUSIONS 

Data  collected  from  cylinders  representative  of  the  oxy¬ 
gen  supply  built  into  Air  Force  EPOS  protective  breath¬ 
ing  equipment  did  not  indicate  any  type  of  systematic 
leakage.  However,  some  cylinders  (7,  7.6%  of  the  total) 
had  oxygen  levels  below  the  design  specification.  For  five 
of  this  group  that  were  only  slightly  below  the  required 
oxygen  level,  it  is  not  definitive  whether  the  deficiency 
would  represent  a  meaningful  change  in  the  performance 
characteristics  specified  by  the  Air  Force  for  the  device. 
The  other  two  have  to  be  considered  a  limitation  to  the 
functional  capabilities  of  the  EPOS.  Steps  should  be  taken 
to  identify  why  the  cylinders  were  deficient  and  definitive 
steps  taken  to  correct  the  problem. 
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FIGURES 


Figure  1.  The  Emergency  Passenger  Oxygen  System 
evaluated  in  this  study.  The  unit  contains  a  single  oxygen 
cylinder  (not  visible)  that  is  normally  opened  to  the  interior  of 
the  unit  when  taken  from  the  packaging  for  donning. 
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Figure  2.  Sampling  of  gases  within  the  EPOS  packaging.  This  is  a  representative  trial  from  Test  1.  The  dark 
line  is  a  voltage  signal  use  to  delineate  the  sampling  period  (left  y-axis).  The  light  gray  boxes  are  the  sample 
collection  periods  used  for  comparison.  The  circles  are  the  oxygen  concentration  (right  y-axis). 
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Figure  3.  Differences  in  weight  observed  between  weight  at  manufacture  and  the  current  weight.  The  production 
batch  number  (x-axis)  is  roughiy  equivaient  to  the  date  of  cylinder  manufacture.  Values  listed  on  the  cylinders 
for  weight  at  manufacture  appear  to  be  representative  batch  weights,  not  the  actual  measured  weight  of  each 
individual  cylinder. 
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Figure  4.  Weight  changes  resulting  from  a  40,000-foot  altitude  exposure.  No  meaningful  weight  change 
was  observed  as  a  result  of  altitude  exposure.  Again,  cylinders  are  listed  by  increasing  production  batch 
designation. 


Figure  5.  Mass  of  oxygen  contained  within  the  cylinders.  The  majority  of  deficiencies  are  clustered  around 
production  batch  numbers  and  a  time  frame  of  assembly  in  1997. 
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